Package rekall :: Module obj :: Class Struct
[frames] | no frames]

Class Struct

source code


A Struct is an object which represents a c struct

Structs have members at various fixed relative offsets from our own base offset.

Nested Classes
  __metaclass__
Give each object a unique ID. (Inherited from rekall.obj.BaseObject)
Instance Methods
 
__init__(self, members=None, struct_size=0, callable_members=None, **kwargs)
This must be instantiated with a dict of members.
source code
 
__hash__(self)
hash(x)
source code
 
__long__(self) source code
 
__int__(self)
Return our offset as an integer.
source code
 
preamble_size(self)
The number of bytes before the object which are part of the object.
source code
 
__repr__(self)
repr(x)
source code
 
__unicode__(self) source code
 
v(self, vm=None)
When a struct is evaluated we just return our offset.
source code
 
m(self, attr, allow_callable_attributes=False)
Fetch the member named by attr.
source code
 
multi_m(self, *args, **opts)
Retrieve a set of fields in order.
source code
 
__getattr__(self, attr) source code
 
SetMember(self, attr, value)
Write a value to a member.
source code
 
walk_list(self, list_member, include_current=True, deref_as=None)
Walk a single linked list in this struct.
source code
 
GetData(self)
Returns the raw data of this object. (Inherited from rekall.obj.BaseObject)
source code
 
__comparator__(self, other, method) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__dir__(self)
Hide any members with _. (Inherited from rekall.obj.BaseObject)
source code
 
__eq__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__format__(self, formatspec)
default object formatter (Inherited from rekall.obj.BaseObject)
source code
 
__ge__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__gt__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__le__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__lt__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__ne__(self, other) (Inherited from rekall.obj.BaseAddressComparisonMixIn) source code
 
__nonzero__(self)
This method is called when we test the truth value of an Object. (Inherited from rekall.obj.BaseObject)
source code
 
__str__(self)
str(x) (Inherited from rekall.obj.BaseObject)
source code
 
cast(self, type_name=None, vm=None, **kwargs) (Inherited from rekall.obj.BaseObject) source code
 
deref(self, vm=None)
An alias for dereference - less to type. (Inherited from rekall.obj.BaseObject)
source code
 
dereference(self, vm=None) (Inherited from rekall.obj.BaseObject) source code
 
is_valid(self) (Inherited from rekall.obj.BaseObject) source code
 
proxied(self) (Inherited from rekall.obj.BaseObject) source code
 
reference(self)
Produces a pointer to this object. (Inherited from rekall.obj.BaseObject)
source code
 
write(self, value)
Function for writing the object back to disk (Inherited from rekall.obj.BaseObject)
source code

Inherited from object: __delattr__, __getattribute__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Class Methods
 
getproperties(cls)
Return all members that are intended to represent some data. (Inherited from rekall.obj.BaseObject)
source code
Class Variables
  obj_name = <No name> (Inherited from rekall.obj.BaseObject)
  obj_parent = <No parent> (Inherited from rekall.obj.BaseObject)
  obj_producers = None
hash(x) (Inherited from rekall.obj.BaseObject)
Properties
  indices
Returns (usually 1) representation(s) of self usable as dict keys.
  obj_size
  obj_end (Inherited from rekall.obj.BaseObject)
  parents
Returns all the parents of this object. (Inherited from rekall.obj.BaseObject)

Inherited from object: __class__

Method Details

__init__(self, members=None, struct_size=0, callable_members=None, **kwargs)
(Constructor)

source code 
This must be instantiated with a dict of members. The keys
are the offsets, the values are Curried Object classes that
will be instantiated when accessed.

Args:
   members: A dict of callables to use for retrieving each member. (Key
     is member name, value is a callable). Normally these are populated
     by the profile system

   struct_size: The size of this struct if known (Can be None).

Overrides: object.__init__

__hash__(self)
(Hashing function)

source code 

hash(x)

Overrides: object.__hash__
(inherited documentation)

__int__(self)

source code 

Return our offset as an integer.

This allows us to interchange Struct and offsets.

preamble_size(self)

source code 

The number of bytes before the object which are part of the object.

Some objects are preceeded with data before obj_offset which is still considered part of the object. Note that in that case the size of the object includes the preamble_size - hence

object_end = obj_offset + obj_size - obj.preamble_size()

__repr__(self)
(Representation operator)

source code 

repr(x)

Overrides: object.__repr__
(inherited documentation)

__unicode__(self)

source code 
Overrides: BaseObject.__unicode__

v(self, vm=None)

source code 

When a struct is evaluated we just return our offset.

Overrides: BaseObject.v

m(self, attr, allow_callable_attributes=False)

source code 

Fetch the member named by attr.

NOTE: When the member does not exist in this struct, we return a NoneObject instance. This allows one to write code such as:

struct.m("Field1") or struct.m("Field2") struct.m("Field2")

To access a field which has been renamed in different OS versions.

By default this method does not allow callable methods specified in overlays. This is to enable overriding of normal struct members by callable properties (otherwise infinite recursion might occur). If you really want to call overlays, specify allow_callable_attributes as True.

Overrides: BaseObject.m

multi_m(self, *args, **opts)

source code 

Retrieve a set of fields in order.

If a field is not found, then try the next field in the list until one field works. This approach allows us to propose a set of possible fields for an attribute to support renaming of struct fields in different versions.

walk_list(self, list_member, include_current=True, deref_as=None)

source code 
Walk a single linked list in this struct.

The current object can be optionally yielded as the first element.

Args:
  list_member: The member name which points to the next item in the
  list.


Property Details

indices

Returns (usually 1) representation(s) of self usable as dict keys.

Using full base objects for indexing can be slow, especially with Structs. This method returns a representation of the object that is a suitable key - either the value of a primitive type, or the memory address of the more complex ones.

Get Method:
unreachable.indices(self)

obj_size

Get Method:
unreachable.obj_size(self)